Privacy Policy

Introduction (key points)

• Everything you create in the App, such as photos, doodles, answers to questions, and memories, is stored in your own iCloud (Apple’s cloud service) and shared only with the partner you are connected with. We do not store it on our servers. We cannot see its contents, either.
• Anything that passes through our relay server, such as notifications and Doodle Together strokes, is encrypted before it is sent, with keys that only your two iPhones hold. We cannot read its contents.
• The App has no account registration. The App does not collect your name, email address, phone number, or Apple Account information (formerly Apple ID). If you email our support, we keep that email (including your email address) for up to 3 years to handle your inquiry (Section 12).
• Our server does nothing but relay notifications and Doodle Together strokes to your partner. We do not store what we relay. The only things we store on our server are aggregate statistics that cannot identify any individual and records used to prevent abuse (such as transformed versions of a random value generated on your device). Communication logs, such as IP addresses, remain in our relay server provider’s systems for up to 7 days (Section 3).
• To analyze purchase status (such as free trials and renewals) and sales, we send records of your App Store purchases to the purchase analytics service RevenueCat (a business in the United States of America). We do not send your name, email address, or Apple Account information (3.5).
• We do not show ads, and we do not track you (that is, combine your data with other companies’ data and use it for advertising).
• Location sharing is off by default. Even when it is on, your partner’s app shows only the distance between the two of you and the time it was last updated (the distance may allow your approximate location to be inferred; see Section 5). Separately from location sharing, your partner sees your local time and the time difference, based on your iPhone’s time zone (Section 4).
• You can delete all of the data you have created at any time from the App’s settings (except for things your partner created and things your partner has saved or taken screenshots of).

Contents

1. Operator
2. Where your data is stored (how the App works)
3. Information we handle
4. Sharing with your partner
5. Location information and photos
6. Purposes of use
7. Provision to third parties
8. Public disclosure under the external transmission rules, entrustment, and handling outside Japan
9. Advertising, tracking, and analytics
10. Secrecy of communications
11. Security control measures
12. Retention periods and deletion
13. Requests for disclosure, correction, suspension of use, and more
14. For minors
15. Changes to this Policy
16. Contact point for inquiries
17. Your U.S. privacy rights

1.Operator

2.Where your data is stored (how the App works)

The App uses Apple’s iCloud (CloudKit) to store data in each of your own iCloud accounts. What you create is stored in your iCloud, and what your partner creates is stored in your partner’s iCloud. Through iCloud’s sharing mechanism, the two are connected so that each of you can only read the other’s data.

• Data stored in iCloud is managed by Apple in accordance with your agreement with Apple (the iCloud Terms and Conditions) and Apple’s Privacy Policy. We cannot view, retrieve, or restore the contents of your or your partner’s iCloud.
• Your data takes up your own iCloud storage space. The App reduces the size of photos before sending and saving them.
• Text and location information are encrypted on your iPhone before being stored in iCloud (the encryption keys are kept in your iCloud Keychain). Photos and other files are also encrypted both in transit and on iCloud’s servers. If you turn on iCloud’s Advanced Data Protection, photos and other files are end-to-end encrypted as well. For details, see Apple’s “iCloud data security overview.”
• If you sign in to iCloud with the same Apple Account, your data comes back on a new iPhone too (iCloud Keychain must be turned on to read text and similar data).
• Important if you can no longer use iCloud Keychain: Text, answers, locations, doodle strokes, and similar data are encrypted with keys in your iCloud Keychain. If you can no longer use iCloud Keychain, for example because your end-to-end encrypted data was reset during Apple Account recovery, this data can no longer be read, and neither Apple nor we can restore it. We recommend saving anything important using the App’s “Export data” feature.

3.Information we handle

3.1 Information handled temporarily for relaying (not stored)

To deliver alerts to the other person’s iPhone, our relay server receives the following information and forwards it as is to Apple’s notification service (APNs) and similar services. Once forwarding is complete, the information is discarded and is not stored or logged (except for the records described in 3.2).

• Notifications and Doodle Together: The recipient device’s token (including tokens for updating Live Activities) and information needed for delivery (notification type and priority, and random IDs that point to records). The contents, such as notification text, nicknames, and doodle strokes, are encrypted before being sent, with keys that only your two iPhones hold, so neither we nor Apple can read them. The only text the relay server can see is a fixed, generic message (“You have something new”). The actual text shown on the Lock Screen is decrypted and displayed on the other person’s iPhone.
• Doodle Together (when both of you have the screen open and are drawing): Encrypted stroke data is relayed over a channel derived from a value known only to the two of you, and is not stored.
• Information needed for communication (IP addresses, dates and times of communications, etc.): To limit the number of transmissions, the relay server handles IP addresses in memory only, for up to 10 minutes (they are not stored). However, records such as IP addresses and the dates and times of communications remain in the systems of our relay server provider (Supabase) for up to 7 days. We review these only to investigate outages and prevent abuse, and we do not use them to identify individuals or for analysis.

3.2 Information we store

3.3 Information we receive from Apple

Through App Store Connect, Apple’s management console for developers, we receive download counts and sales figures, as well as crash reports and usage statistics if you have allowed “Share With App Developers.” This information is collected and aggregated by Apple and is not in a form that allows us to identify you. Apple handles purchases and refunds, and we do not receive information that tells us who made a purchase, such as your name or Apple Account information (the purchase records in 3.5 are also handled under an anonymous ID). App Store Server Notifications (Apple’s system for notifying developers of purchases and renewals) are sent to RevenueCat, Inc., not to our own servers, and are used only for purchase status and sales analytics.

3.4 Information we do not collect

Except for what we handle temporarily for relaying as described in 3.1, we do not collect names, email addresses (except in inquiries), phone numbers, postal addresses, Apple Account information, address books (contacts), payment information such as credit card details, or advertising identifiers. Nor do we collect information such as gender, race, creed, or medical history as data fields.

3.5 Purchase analytics (RevenueCat)

To quickly understand purchase status (such as free trials starting and converting to paid plans, renewals, cancellations, and refunds) and sales, and to improve the App and its pricing plans, we use the purchase analytics service RevenueCat (RevenueCat, Inc., United States of America). Apple continues to handle the purchases themselves. RevenueCat plays no part in making purchases or in deciding whether you can use Premium.

• Information sent: Records of your App Store purchases (Apple’s signed transaction information, such as the product; the dates and times of purchase, renewal, and expiry; whether it is a free trial; the price and currency; the country or region; the transaction ID; and the value attached to the purchase, which is derived from your iCloud user and contains no name or Apple Account information) and your purchase history; an anonymous ID that RevenueCat’s SDK creates automatically within the App; and information such as your iPhone model, iOS and App versions, and language and region settings. RevenueCat’s servers also handle your IP address, which is needed to communicate with them.
• Information not sent: Your name, email address, phone number, Apple Account information, payment information such as credit card details, advertising identifiers, or the data you create in the App (photos, answers, locations, etc.). We also do not register your name or a user ID with RevenueCat.
• When it is sent: When you make a purchase, when you use “Restore Purchases,” and when you open the App (to check purchase status).
• RevenueCat handles this information on our behalf (entrustment) and manages it under its own privacy policy (https://www.revenuecat.com/privacy).

4.Sharing with your partner

The App is designed for sharing information with the partner you are connected with. Once you connect, the following information is also shown on your partner’s iPhone:

• Your profile (nickname, icon, mochi color, birthday, mood)
• What you create (photos, doodles, memories, bucket list items, anniversaries, comments, message cards, etc.). The contents of a message card are not shown until its delivery date.
• Your answers to questions, quizzes, and games (shown after your partner has also answered the same question)
• If you have turned on location sharing, the distance between the two of you and the time your location was last updated (Section 5)
• Your iPhone’s time zone (a region name such as “America/New_York”), and your local time and the time difference between the two of you based on it. It is also used to deliver message cards from your partner at your local time. Daily Log photos also record the time zone they were taken in and show the local time where they were taken. Your time zone reaches your partner even when location sharing is off, and it may indicate the country or region you are in.
• The fact that you are using Premium

About the invite link: Until you are connected, anyone who opens the invite link you send can join your shared space. Please send the link only to the person you want to connect with. Until you are connected, someone who opens the link can see only your nickname and mochi color. The link stops working after 72 hours, and once you are connected, no one can join through it. If someone you did not expect has joined, the App automatically removes them and notifies you.

Your partner can save what is shown to them, for example by taking screenshots. Please post only what you are comfortable sharing.

5.Location information and photos

Location information

• Location information is used only to show the distance between the two of you. Sharing is off by default, and you can turn it on or off at any time with “Location sharing” in Settings.
• When sharing is on, your iPhone encrypts only a single point, your most recent location, and stores it in your iCloud (it is overwritten each time, so no history of your movements is kept). Your partner’s iPhone reads this location to calculate the distance, but the App shows only the distance and the time it was last updated; it does not show the place on a map or the latitude and longitude.
• Please note: Although the App shows only the distance and the time it was last updated, combining the distance with your partner’s own location may allow your approximate location to be inferred. If this concerns you, choose “Nearest 1 km” or turn sharing off.
• Your location is rounded on your iPhone before it is stored: to a precision of about 1 km (0.6 mi) with “Nearest 1 km (recommended),” the setting used when you turn sharing on, or to about 100 m (330 ft) if you choose “Nearest 100 m.” (Where miles are used, these settings are shown as “Nearest 0.6 mi” and “Nearest 330 ft.”)
• When you turn sharing off, disconnect, or delete your data, the location stored in iCloud is also deleted.
• We never receive your location information.
• If you add a place to a memory, the place’s name and location are stored in your iCloud together with the memory and shown on the memory map you share. To look up place names, the App uses Apple’s map service (Section 8).

Photos

• Information contained in photos, such as where they were taken (Exif data), is removed on your iPhone before saving.
• The App uses only the photos you choose or take. It does not read your entire photo library.

6.Purposes of use

We use the information described in Section 3 only for the following purposes:

1. To deliver notifications, Live Activities, widget updates, and Doodle Together strokes to your partner’s iPhone (3.1)
2. To prevent abusive use of the relay (such as sending large volumes of notifications) and to keep the App safe (3.2)
3. To make the App, including its onboarding and purchase screens, easier to use (the anonymous aggregate statistics in 3.2)
4. To analyze purchase status (such as conversions from free trials, renewals, and cancellations) and sales, and to improve the App and its pricing plans (the purchase analytics in 3.5)
5. To respond to inquiries and reports
6. To inform you of changes to the Terms of Use and other important notices

Data stored in iCloud is used only on your and your partner’s iPhones, to run the App’s features (such as calculating day counts and anniversaries, questions, Daily Log, doodles, and widgets). We do not use this data.

If we use information in a way unrelated to these purposes, we will obtain your consent in advance.

7.Provision to third parties

We do not provide personal information to third parties without your consent, except in the following cases:

1. Cases based on laws and regulations
2. Cases in which it is necessary to protect a person’s life, body, or property and it is difficult to obtain the consent of the individual concerned
3. Cases in which it is especially necessary to improve public health or promote the healthy development of children and it is difficult to obtain the consent of the individual concerned
4. Cases in which it is necessary to cooperate with a national government agency, a local government, or the like in performing affairs prescribed by laws and regulations, and obtaining the consent of the individual concerned is likely to interfere with the performance of those affairs
5. Cases in which information is provided in connection with a business succession (such as a merger or business transfer) (even in this case, the information will be handled within the scope of this Policy)

What is shown to your partner as described in Section 4 is shared from your iCloud with your partner because you chose to connect; it is not a provision of information by us.

8.Public disclosure under the external transmission rules (Article 27-12 of the Telecommunications Business Act), entrustment, and handling outside Japan

The App uses the services of the following businesses and sends the following information from your iPhone. This section also serves as the public disclosure required under Article 27-12 of the Telecommunications Business Act (external transmission of information about users). You can also open this section from My page > “Data sent to third parties” in the App.

In-app purchases are processed by Apple under its own privacy policy, and we do not receive any payment information. The purchase records sent to RevenueCat do not include payment information either.

For entrusted parties located outside Japan, in accordance with the Act on the Protection of Personal Information (APPI), we have confirmed through contracts and publicly available information that each entrusted party has established a system for taking measures of the same level as those required under Japanese laws and regulations. For information on the personal information protection system of the United States of America, please refer to the information published on the Personal Information Protection Commission’s website (in Japanese). Upon request, we will inform you of the measures taken by our entrusted parties.

9.Advertising, tracking, and analytics

• The App does not display ads. It does not include any SDKs for serving ads, either.
• We do not combine your information with information from other companies’ apps or websites to use it for advertising or for measuring advertising effectiveness (tracking). For that reason, the App does not show a dialog asking for permission to track.
• To improve the App, we use the anonymous aggregate statistics described in 3.2 and the purchase analytics (RevenueCat) described in 3.5. We never use the information sent to RevenueCat for advertising or tracking. We do not use any other external analytics services.

10.Secrecy of communications

We protect the secrecy of the communications we relay, and we do not view their contents or use them for any other purpose.

Even when relaying exchanges between the two of you (such as notifications and doodle strokes), we do not view, store, or use their contents for any other purpose. Relayed content is encrypted with keys that only your two iPhones hold, so we cannot read it either (3.1). We check the contents only (1) when, in a report or inquiry, you show us the contents and consent to our reviewing them; (2) in cases based on laws and regulations; or (3) when there is an urgent need to protect a person’s life, body, or property.

11.Security control measures

To prevent leakage, loss, or alteration of the information we handle, we take measures such as the following:

• Protection by not holding data: We do not store the data you create on our servers, and we do not store relayed content either. Because the App is designed so that we do not hold this data in the first place, it cannot leak from us.
• Technical measures: All communications are encrypted (HTTPS/TLS). In addition, notifications and doodle strokes that pass through the relay server are encrypted before they are sent, with keys that only your two iPhones hold (end-to-end encryption). Requests to the relay server are authenticated per device, and the number of transmissions is limited. Secrets such as the relay server’s keys are not included in the App and are managed on the server side.
• Organizational and personnel measures: We keep the number of people with administrative privileges to a minimum and use multi-factor authentication for access to administrative consoles. We have established rules for handling information and require the people in charge to follow them.
• Physical measures: We do not install our own servers; instead, we use cloud services from providers that implement physical security measures.
• Understanding the external environment: We handle the relay server, inquiry emails, and purchase analytics through services provided by businesses in the United States of America. We take security control measures based on an understanding of the personal information protection system of the United States of America.

12.Retention periods and deletion

Information we store

• Relayed information: Not stored.
• Records used to prevent abuse: Automatically deleted after 48 hours. Values used to prevent duplicate transmissions are automatically deleted after 24 hours, and records of devices blocked for abusive use are kept until the block is lifted.
• Communication logs remaining in the relay server provider’s systems (IP addresses, dates and times of communications, etc.): Automatically deleted within 7 days.
• Anonymous aggregate statistics: Only the daily totals are kept, for 3 years.
• Purchase records (RevenueCat): Kept in RevenueCat’s systems while RevenueCat provides its service to us, and then deleted or anonymized in accordance with RevenueCat’s privacy policy and our agreement with RevenueCat. If you would like your purchase records deleted, contact us at the contact point in Section 16 (contact@crop.tokyo), and we will ask RevenueCat to delete them.
• Inquiry information: Deleted 3 years after we finish responding.

Data stored in iCloud

The data in your iCloud remains in your iCloud until you delete it. We can neither delete nor restore it.

• Deleting everything: From My page > “Delete all Futamochi data” in the App, you can delete the App’s data in your iCloud. When you do, sharing with your partner also stops, and any Premium your partner was using through your purchase also becomes unavailable (your subscription is not canceled automatically). The things you created (photos, answers, anniversaries, memories, comments, etc.) also disappear from your partner’s screen. Images and other items temporarily stored on your partner’s iPhone are also deleted the next time your partner’s app connects to iCloud. Anything your partner has saved to their photos and any screenshots cannot be deleted. Deletion cannot be undone.
• If the App appears under Settings > [your name] > iCloud > Storage on your iPhone (the wording varies slightly depending on the iOS version), you can also delete its data from there.
• Deleting the App alone does not erase your data in iCloud. If you install the App again, your data comes back.
• Things your partner created are in your partner’s iCloud, so you cannot delete them.

Disconnecting from your partner

When you disconnect, iCloud sharing between the two of you stops from that point on.

• If you choose “Keep” when you disconnect, the things you created stay stored in your iCloud. However, the App cannot show them (“Earlier records” in My page only tells you that they are stored). If you no longer need them, choose “Delete” when you disconnect, or delete them later from My page > “Delete all Futamochi data.”
• Things your partner created are no longer shown to you and are also deleted from the temporary storage on your iPhone.
• Your location information is deleted immediately.
• If the same two people connect again, earlier records do not come back to the App’s screens. The new connection starts fresh.
• You can disconnect without the other person’s consent. No notification is sent to them; the change is shown the next time they open the App.

13.Requests for disclosure, correction, suspension of use, and more

Under the Act on the Protection of Personal Information (APPI), you may request, with respect to your personal data that we hold, notification of the purposes of use; disclosure (including records of provision to third parties); correction, addition, or deletion of its contents; suspension of use or erasure; and cessation of provision to third parties.

• The data you create in the App is in your iCloud, not with us. You can view, change, or delete it in the App at any time (by editing or deleting on each screen, or with “Export data” and “Delete all data” in Settings).
• The personal data about you that we hold is mainly inquiry information. Please send requests by email to the contact point in Section 16. After verifying your identity, we will respond in accordance with laws and regulations.
• Because the anonymous aggregate statistics and the records used to prevent abuse cannot identify you, we are unable to locate the portion relating to you in response to a request. The purchase records in 3.5 are handled under an anonymous ID, but if you request deletion, we will ask RevenueCat to delete them (Section 12). To locate yours, we may ask for details of your App Store purchase (such as the date and time of purchase), and we may still be unable to locate them.
• Disclosure will be made by the method you prefer: either by providing an electronic record (such as sending a data file by email) or in writing.
• If a request is made by an agent, we may ask for documents that confirm their authority to act on your behalf.
• In principle, we do not charge a fee for disclosure requests.

14.For minors

• If you are under 18, please use the App only after obtaining the consent of your parent or guardian.
• Children under 13 may not use the App.
• Sending or storing sexual images of anyone under 18 is prohibited by law (Act on Regulation and Punishment of Acts Relating to Child Prostitution and Child Pornography, and the Protection of Children).

15.Changes to this Policy

We may change this Policy to reflect changes in laws and regulations or the addition of new features to the App. Before an important change takes effect, we will let you know clearly, for example through an in-app notice. Where required by laws and regulations, such as when we significantly change the purposes of use, we will ask for your consent again.

16.Contact point for inquiries

For questions, consultations, or complaints about this Policy or our handling of personal information, please contact:

It may take a few days for us to reply. For help using the App, please also see the FAQ on our Support page.

17.Your U.S. privacy rights

This section applies to residents of California and other U.S. states with similar consumer privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). It supplements the rest of this Policy and appears only in this English version.

• Categories of personal information we collect (in the past 12 months): identifiers (IP addresses in relay communication logs, the anonymous ID created by RevenueCat’s SDK, device tokens handled for relaying, and your email address if you contact us); commercial information (records of your App Store purchases, 3.5); internet or other electronic network activity information (relay communication logs, 3.1); and the contents of inquiries you send us. We collect them from you, your device, and RevenueCat, for the purposes in Section 6, and keep them for the periods in Section 12. The data you create in the App is stored in your own iCloud, and we do not collect it. We do not collect precise geolocation, and we do not use sensitive personal information to infer characteristics about you.
• Disclosure: We disclose personal information only to the service providers listed in Section 8 (such as Supabase, RevenueCat, and Google), for the business purposes described there.
• No sale or sharing: We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months, and we have no actual knowledge of selling or sharing the personal information of consumers under 16. Because of this, there is nothing to opt out of.
• Your rights: You have the right to know what personal information we have collected about you (including the categories, sources, purposes, and the specific pieces), the right to have it deleted, and the right to have inaccurate personal information corrected. You can view, change, and delete the data you create in the App yourself at any time (Section 13).
• How to make a request: Email contact@crop.tokyo. We will verify your request using information you provide (for example, the email address you used to contact us) and respond within 45 days. You may use an authorized agent; we may ask for proof that the agent is authorized to act for you. Because the anonymous aggregate statistics, the records used to prevent abuse, and the purchase records are not linked to your identity, we may be unable to locate the portion relating to you (Section 13). For purchase records, we will ask RevenueCat to delete them on your request (Section 12).
• No discrimination: We will not deny you service, charge you a different price, or provide a different quality of service because you exercised these rights.